Action now can limit noncompliance with a historic CRA rewrite

A version of this article first appeared in the September BAI Executive Report: Navigating effective risk management. You’ll find more insight within the report on a new approach to commercial real estate, assessing liquidity and credit risk, fraud considerations and more.

The Community Reinvestment Act (CRA) has been modernized to better reflect the digital age, say proponents behind the intricate overhaul.

As a quick review, the decades old CRA was enacted to correct shortfalls in access to credit and, its champions argue, expand financial inclusion. It was created after historic redlining had come to define lending inequities. That was especially true of homeownership, the foundation for generational wealth-building for many in the U.S.

For sure, updating any seasoned legislation includes input from several stakeholders from the Federal Reserve to community-activist groups, and proposals go through many iterations. In the end, compliance demands will vary by bank size and lending model. With final CRA passage late last year, BAI presented key slides to help your organization parse how the rule has changed. That includes which aspects of lending operations will be impacted, and when.

And while most compliance targets for the new-look CRA ramp up in 2026 and 2027, preparing to comply with this robust legislation will take time and resources. Failure to prepare introduces regulatory risk that could prove costly to the bottom line and to reputation. Plus, as the CRA is just one on a long list of proposed and approved banking regulations that could impact operations, it goes without saying that our industry is facing a potentially complex supervisory landscape with floating reporting dates.

For now, we’ve gathered a panel for help navigating the CRA, although this overview is intended to simply be a kickoff to thorough policy education and enforcement at your bank or credit union.

Christopher Boersma, Product Manager in Compliance, BAI

This is one of the most complex pieces of legislation ever written. It’s almost 1,500 pages and there’s so many different formulas and metrics involved that I feel like banks initially are going to struggle a little bit and they’re going to need a lot of resources to help them get ready for all the changes.

While most of the effective dates are not until 2026, banks will need to start digging now because they’re going to need every bit of the time to get ready — making sure they first understand it and pulling accurate data.

You know how the phrase goes, ‘How do you eat an elephant? One bite at a time.’ That’s my suggestion for banks preparing for this rule. Start with understanding the rule then bring in a team to help because one person won’t be able to tackle 100% of the preparation. It’s going to take a team across all functions to do it: community reinvestment officers, compliance officers and personnel from small business lending and closed-end mortgage lending.

Senior management must set the tone from the top. Be sure to train staff to understand what’s different from the old rule versus the new rule, what kind of information must be collected, and how to put it together going forward so that the bank or credit union can be properly evaluated with accurate information.

Melissa Blaser, Partner, Wipfli LLP

The performance criteria that banks are going to fall under depends on whether they’re considered a large bank, an intermediate bank or a small bank.

Large and intermediate banks have the most to deal with, as their performance criteria are changing. Large banks are also going to have new data collection rules and large and intermediate banks will potentially have additional assessment areas that they’re going to be evaluated under.

Large banks will need to look at the systems used for data collection and determine if those systems need to be upgraded to handle the new data collection requirements or if some data will be collected manually, or if new systems may be needed.

Large banks will want to determine how many assessment areas they are going to have, and where they are going to be evaluated, knowing this could change each year. But looking at this now will help a large bank determine whether they will have many new retail lending assessment areas or if they will primarily have their facility-based assessment area like they’ve had in the past. Large and intermediate banks will also need to consider the impact of a nationwide outside retail lending assessment area.

The product lines that are being evaluated are also changing, in terms of what types of loans will be assessed. Small business, small farm and home mortgage loans will still be the product lines, but now automobile loans may be assessed if a bank is a major automobile loan lender, with 50% or more of their loans in the product line. In addition, only home mortgage and small business loans will be assessed in the new retail lending assessment areas.

To be a major product line considered within the assessment, small business, small farm and home mortgage loans will need to be 15% or more of the total. Banks may want to consider now what they think their major product lines will be, so they can monitor performance in making those loans in low- and moderate-income areas within their assessment areas.

Intermediate banks also have the new retail lending test, like large banks do, but will not have the data collection and reporting requirements. So intermediate banks will want to start looking at the retail lending test criteria and how that may affect their performance in their facility-based assessment areas as well as potentially outside retail lending areas.

Banks under $600 million in assets will not have any changes to their small bank lending test, so they don’t necessarily have to change anything. But small banks have the option of being assessed under the new retail lending test, so they might start thinking about whether that would be advantageous.

Small banks may consider opting into the retail lending test if they’ve had a hard time making the majority of their loans inside their assessment areas. If a small bank tends to lend more outside the facility-based assessment area, the new retail lending test, which considers lending performance in other areas, might be helpful.

All banks still have the option of developing a strategic plan if the bank struggles with meeting certain performance criteria. A strategic plan must be approved by the bank’s regulator, so starting the process now might be something banks should consider, as they look at how they may perform under these new tests.

After banks have considered the new requirements and determined where their new assessment areas may be, if applicable, they might want to consider conducting a self-assessment under the new rules. It’s not required, but banks may want to see how they will perform under the new rules before their examiners perform the first CRA performance evaluation.

A self-assessment would allow banks to see if what they are currently doing is adequate or if they may need to improve performance in certain areas. This will allow a bank time to improve their performance before their next CRA examination.

Bank regulators have indicated they will be looking at a bank’s change management process in adopting the new CRA requirements; therefore, all efforts should be formally documented.

Jason Keller, Director, Wolters Kluwer Compliance Solutions’ U.S. Advisory Services Group

Today, institutions are thinking about their own preparation strategy in three ways. The first way is about the new data collection and reporting elements that they did not have to comply with under the legacy rule. The biggest changes are for institutions with more than $10 billion in assets, as they will now have much more rigorous reporting standards, and information about their lending, investments and services will be categorically much more complicated to capture, but not insurmountable.

One area of particular concern is the standard by which they will have to gather their deposits. Now granted, that’s not on a line-by-line basis but at an aggregate level, yet still, that standard will be net new compared to the legacy rule.

The second thing institutions over $10 billion are doing to prepare is figuring out how their market managers are going to be engaged within the community, because changes in the new reg are really designed for institutions to be more transparent. I think it’s going to take a change in how institutions are looking at their outreach, looking at which nonprofits or community groups they are engaged with and thinking really about the impact of their community development activities.

For institutions of all sizes, the first thing that we recommend is to conduct a risk assessment and a community needs review on their current CRA program, understanding what works, what doesn’t, and what areas need adjustments. Then it’s about really dissecting this very large and complex rule.

The retail lending test is something that institutions with more than $2 billion in assets are most uncertain about, because a lot of the metrics that regulators will be evaluating them are not yet put forward. Yes, the calculations are put forward, but to really comply with the retail lending standards there has to be a market benchmark — how institutions across a given marketplace will be held to a standard. That will come once the regulators can review the data filed and look at trends, but the only way to do that is to capture all the new reporting that has to take place.

Institutions are struggling right now to think about this — not so much their plan for 2026, but as they start to do forecasting for 2027. If they have any mergers or acquisitions, they will have to think about how the new rule impacts that. So effectively, CRA is going to have to become much more top-of-mind as institutions grow.

Across the industry, we’re hearing a lot about success planning — what does a CRA officer need to do to be successful? What percentage of their time will be spent more on analytics? What percentage of their time will be based on benchmarks and data, versus community organizing work? Will they need to adjust how they will interact with the nonprofit sector?

This is now the time to engage CRA as a business strategy — not only in the markets where they have a physical presence but also in markets in which they do not but are still very engaged — or would like to become more so. This is where the retail lending assessment test is creating the most angst, though there is currently an injunction against the modernized rule, which has led to many banks staying in a “holding pattern.”

I would advise institutions to think about both the “how” and the “what” needs be done to comply with the new rule. Institutions that have outstanding or satisfactory CRA ratings very much have an approach, but they should now determine whether the strategies that they have in place are going to be affected without the other half of these metrics available.

Successful CRA programs will have to take some leaps of faith to evolve. I think that there will be an opportunity for conversation with the regulators about what success looks like. But if I could give institutions one piece of advice, it would be to focus on the true impact of their lending, their investments and resources.

There are brand new vectors for institutions with more than $2 billion in assets, items that I’ve been stressing for a very long time around ways of qualifying leadership — said differently, how can a bank maximize how it uses its limited resources to do the greatest good.

CRA incentivizes banks to focus on markets that are traditionally underserved economically. Under today’s CRA, they are focused on what it truly means to revitalize or stabilize. If institutions can do something in 2025 to shore up what they believe or how they believe those definitions impact their work, they will be much better suited to respond to this large regulatory change.

Regardless of what happens with the injunction, there are still current CRA regulations that banks must comply with. They still must go forth and respond to the communities in which they serve. It’s also important to use CRA as a competitive advantage and prepare for the future.

We are in a period of regulatory uncertainty, and some institutions are hesitant to invest the resources. But my advice to them is that you don’t necessarily have to invest more — just capture data differently to be able to comply.

Katie Kuehner-Hebert is a contributor writing for BAI.